Social engineering insurance explained: How to protect your business

In recent years, social engineering attacks such as phishing have become more prevalent and caused more damage to businesses. These attacks don’t rely on hacking software but on manipulating people, making them harder to detect and prevent.

Many companies are turning to social engineering insurance to protect themselves from the potential financial and reputational fallout of an incident. In this article, we’ll break down how this coverage works, what it includes, and how to decide if your business needs it.

What is social engineering fraud?

Social engineering fraud refers to scams that rely on psychological manipulation to convince the targets into surrendering restricted, sensitive information and funds by exploiting their trust. These tactics often include phishing emails, fraudulent phone calls, fake invoices, or spoofed messages that appear legitimate.

Because social engineering targets human behavior rather than software vulnerabilities, it’s notoriously difficult to detect.

With the rapid advancement of artificial intelligence, experts warn of “Social Engineering 2.0” — that’s where cybercriminals employ AI-driven, highly targeted attacks that make them more sophisticated and even harder to detect.

In the past few years, these attacks have become commonplace. According to a 2024 report, 79% of account takeover attacks originated with a phishing attempt.

The losses associated with these attacks have also been consistently increasing. According to the FBI’s 2023 Internet Crime Report, U.S. businesses reported nearly $3 billion in losses due to business email compromise scams, which are a prevalent form of social engineering.

Most common types of social engineering attacks

Phishing: Phishing is by far the most common type of SE attack. Typical delivery methods include emails, online chat clients, or impostor websites. Phishing contacts are typically designed to deliver a sense of urgency or fear in order to trick users into giving up sensitive information or funds.

Spear Phishing: This is a highly targeted form of phishing where attackers impersonate trusted individuals, such as CEOs, to trick specific targets — typically financial officers — into transferring funds. Spear phishing attacks require considerable effort on the part of the attacker but are much harder to detect. These emails often mimic real language, signatures, and email addresses, making them hard to spot. As users grow more cautious of generic phishing, spear phishing has become more common due to its higher success rate and sophistication.

Baiting: Baiting involves scammers offering something enticing to the user in exchange for their logins or other sensitive information. The “bait” can come in digital or physical form. Once it is taken, malicious software can be delivered directly into the user’s system.

Vishing: Vishing attacks are conducted via phones by recreating an organization’s IVR system. Unsuspecting users are then tricked into calling the fake phone number and giving away sensitive information. 

Scareware: Scareware attacks involve tricking a user into believing that their computer has been infected with malware or that they have accidentally downloaded illegal content. The targeted party is then offered a fake solution, exposing themselves to the attacker’s malware.

How to get insurance coverage for social engineering claims?

Unlike other types of cybercrime, social engineering attacks are a bit more complicated to get insurance coverage for. In many cases, a special policy extension is warranted to incorporate a social engineering event into your scope of coverage. 

Do cyber insurance policies cover social engineering?

The answer is, it’s complicated. You may think that it would be easy to get coverage for social engineering fraud. But, unfortunately, it’s not as simple as filing a claim with your standard cyber insurance policy.

Cyber insurance will only cover a social engineering claim if your network or device was breached or compromised. This means if the source of the attack was from a fraudulent email, text, or phone call, cyber policies will not cover the claim.

Cyber liability insurance policies often exclude or limit coverage for social engineering attacks through callback provisions. These provisions require companies to verify certain actions, like wire transfers, through a secondary form of confirmation. This usually involves calling the requester at a pre-approved number. If this extra step isn’t taken, the insurer may deny the claim, even if the attack was clearly fraudulent.

Here’s a brief video walkthrough of what a cyber insurance policy covers:

Commercial crime insurance

The main business insurance policy that covers social engineering fraud is commercial crime insurance. However, as with just about everything in the insurance world, your coverage depends on the fine print. 

Crime policies often contain exclusionary wording that precludes coverage for the voluntary parting of property or funds to a third party. In simpler terms, if an employee is tricked into willingly sending money, even under false pretenses, the loss may not be covered.

The fraudulent impersonation of a vendor, executive, another employee, or client does not trigger coverage under a crime policy, and the computer fraud extension will also not apply. Additionally, fraudulent email prompting action does not fall within the policy definitions to provide coverage since no unauthorized instructions were entered into a computer system to electronically manipulate the transaction.

This is why it’s important to discuss the coverage details with your broker. Properly crafted cyber liability and crime policies should indemnify you for any financial loss stemming from social engineering attacks.

Why invest in insurance to protect your business from social engineering fraud?

In an increasingly technology-powered world, business owners need to understand the risks associated with social engineering. While there are ways to prevent the attacks from occurring, it’s smart to have cyber insurance and a commercial crime policy in place as a safety net in the worst-case scenario. 

Cyberattacks are becoming more sophisticated

A recent study shows that AI-generated phishing attempts are much more effective, with 78% of individuals opening AI phishing emails and one in five clicking on the malicious content inside the emails. With the rise of artificial intelligence, deepfakes, and other advanced tools, cyberattacks have become much more advanced and can cause more damage to businesses. 

Prevention isn’t foolproof

There are many different ways to prevent cyber incidents from occurring. Obviously, if possible, your best defense against social engineering attacks is to avoid them altogether. That said, this is often easier said than done. Comprehensive insurance fills in the gaps in your incident response plan. At the end of the day, a single employee mistake can lead to a costly social engineering attack, so it’s always smart to make sure your insurance policy covers you in worst-case scenarios. 

Highly publicized examples of social engineering attacks

• In February 2024, a finance employee at a multinational corporation was deceived into transferring $25 million after participating in a video conference where fraudsters used generative AI. The scammers created a deepfake of the company’s CFO. 
• European retailer Pepco Group was the target of a phishing scheme in 2024 that resulted in the company losing approximately €15.5 million. The attackers successfully spoofed legitimate employee emails and tricked the company’s finance staff into transferring funds.
• In March 2025, North Korea’s Lazarus Group launched a social engineering campaign called “ClickFake.” The group targeted employees of cryptocurrency organizations by sending fake job offers. Unsuspecting employees were tricked into clicking malicious links, leading to the deployment of custom malware known as “GolangGhost,” which gives attackers remote access to devices and programs.
• A phishing campaign in April of 2025 exploits Google’s DomainKeys Identified Mail (DKIM) authentication. Attackers sent emails from “no-reply@google.com,” mimicking legitimate Google emails and deceiving recipients into providing their credentials. 

Cost of social engineering insurance coverage

As with all other types of insurance, your company’s ability to avoid an incident and coverage limits are the two biggest factors in determining your social engineering insurance costs.

The type of insurance policies you invest in will also obviously play a major role in your premium costs. For example, cyber liability insurance costs between $1,200 and $7,000 per year for more businesses. 

Additional factors influencing your premium

Sensitive information: Number of unique Personal Identifiable Information (PII) or Protected Health Information (PHI) records stored or maintained on your systems.

Number of employees: More employees mean more vectors of attack and increase the chance of an incident. 

Revenue: Companies with higher revenue generally make for more tempting targets and have more to lose. 

State of security: Companies with more sophisticated and developed cybersecurity are less vulnerable to social engineering attacks.

Financial controls: Strong financial controls in place will protect companies from manipulation and huge financial losses.

Best practices for preventing social engineering attacks

As we mentioned, the best way to protect your business from phishing or other types of social engineering is to prevent them altogether. Here are some of our top tips for reducing your risk and avoiding social engineering attacks.

Implement security controls

Use advanced measures such as multifactor authentication (MFA), unique passwords, data encryption, and endpoint detection solutions to strengthen your cybersecurity. These simple steps are easy to implement and make it harder for attackers to gain access — even if they do obtain login credentials.

Train employees

Your employees are the first line of defense against social engineering. At the end of the day, nearly three-quarters of all social engineering attacks occur due to some element of human error. Training your staff to spot phishing emails and other red flags can help you significantly reduce your risk of experiencing a social engineering attack.

Regularly update your system

One of our biggest pieces of advice is to keep your software and security tools up-to-date. Many attacks are preventable, as cybercriminals often exploit outdated systems and known vulnerabilities.

Use email spam filters

With so many social engineering attacks starting with a phishing email, you can significantly cut down your risk by implementing advanced spam filters in your email. Doing so will prevent the majority of spoofed emails from ever reaching your employees’ inboxes. Of course, you can’t expect spam filters to catch everything, but they will significantly reduce your exposure to common scams.

Protect your business from social engineering

Even the most well-prepared businesses can fall for a convincing scam. That’s why investing in social engineering insurance is the smartest and most proactive step in protecting your company’s future.

Get a quote with us today and make sure your business is protected from social engineering fraud.